@lpm-registry/cli 0.2.4 → 0.2.5

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.2.5] - 2026-03-19
+
+### Added
+
+- **`lpm npmrc` command** — Generates a 30-day read-only token and writes it to `.npmrc` for local development. Auto-adds `.npmrc` to `.gitignore`. Makes `npm install` work without env vars or manual token setup.
+- **`lpm setup --oidc` flag** — Exchanges CI OIDC token (GitHub Actions, GitLab CI) for a short-lived read-only install token. Eliminates static `LPM_TOKEN` secrets in CI. Falls back to `${LPM_TOKEN}` placeholder if OIDC is unavailable.
+- **OIDC read scope support** — Server-side OIDC token exchange now accepts `?scope=read` for install-only tokens (30 min TTL). Uses Supabase OAuth identity linking instead of trusted publisher config.
+
+### Changed
+
+- OIDC module refactored for reuse — `exchangeOidcInstallToken()` auto-detects CI environment and exchanges for read-only tokens
+- `lpm setup` default mode now mentions `lpm npmrc` and `--oidc` in help output
+
 ## [0.2.4] - 2026-03-18
 
 ### Added

package/bin/lpm.js

@@ -19,6 +19,7 @@ import { logout } from "../lib/commands/logout.js"
 import { marketplaceCompare } from "../lib/commands/marketplace-compare.js"
 import { marketplaceEarnings } from "../lib/commands/marketplace-earnings.js"
 import { mcpRemove, mcpSetup, mcpStatus } from "../lib/commands/mcp-setup.js"
+import { npmrc } from "../lib/commands/npmrc.js"
 import { openDashboard } from "../lib/commands/open.js"
 import { outdated } from "../lib/commands/outdated.js"
 import { poolStats } from "../lib/commands/pool-stats.js"
@@ -202,8 +203,18 @@ program
 	.command("setup")
 	.description("Configure .npmrc for LPM packages (@lpm.dev scope)")
 	.option("-r, --registry <url>", "Custom registry URL")
+	.option(
+		"--oidc",
+		"Exchange CI OIDC token for install access (no secrets needed)",
+	)
 	.action(setup)
 
+program
+	.command("npmrc")
+	.description("Generate a read-only .npmrc token for local development")
+	.option("-d, --days <number>", "Token expiry in days (default: 30)")
+	.action(npmrc)
+
 program
 	.command("config [action] [key] [value]")
 	.description("Manage CLI configuration (list, get, set, delete)")

package/lib/commands/npmrc.js

@@ -0,0 +1,140 @@
+import fs from "node:fs"
+import path from "node:path"
+import { request } from "../api.js"
+import { getRegistryUrl, getToken } from "../config.js"
+import { createSpinner, log, printHeader } from "../ui.js"
+
+/**
+ * Generate a read-only .npmrc token for local development.
+ * Creates a 30-day scoped token and writes it to the project's .npmrc.
+ * Also ensures .npmrc is in .gitignore to prevent accidental commits.
+ */
+export async function npmrc(options) {
+	printHeader()
+
+	const token = await getToken()
+	if (!token) {
+		log.error(
+			'You must be logged in to generate an .npmrc token. Run "lpm login" first.',
+		)
+		process.exit(1)
+	}
+
+	const projectRoot = process.cwd()
+	const npmrcPath = path.join(projectRoot, ".npmrc")
+	const gitignorePath = path.join(projectRoot, ".gitignore")
+
+	// Check for package.json
+	const pkgJsonPath = path.join(projectRoot, "package.json")
+	if (!fs.existsSync(pkgJsonPath)) {
+		log.warn("No package.json found. Run this command in your project root.")
+	}
+
+	// Derive project name for the token label
+	let projectName = "project"
+	if (fs.existsSync(pkgJsonPath)) {
+		try {
+			const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, "utf8"))
+			if (pkg.name) {
+				projectName = pkg.name.replace(/[^a-zA-Z0-9._-]/g, "-")
+			}
+		} catch {
+			// Invalid package.json — use default name
+		}
+	}
+
+	const expiryDays = parseInt(options?.days, 10) || 30
+	const spinner = createSpinner("Creating read-only token...").start()
+
+	// Call server to create a scoped read-only token
+	let readToken
+	let expiresAt
+	try {
+		const tokenName = `npmrc-${projectName}-${new Date().toISOString().slice(0, 10)}`
+		const response = await request("/-/token/create", {
+			method: "POST",
+			body: JSON.stringify({
+				scope: "read",
+				name: tokenName,
+				expiryDays,
+			}),
+			headers: { "Content-Type": "application/json" },
+		})
+
+		if (!response.ok) {
+			const text = await response.text()
+			throw new Error(`Token creation failed: ${response.status} ${text}`)
+		}
+
+		const data = await response.json()
+		readToken = data.token
+		expiresAt = data.expiresAt
+		spinner.succeed("Read-only token created.")
+	} catch (error) {
+		spinner.fail(`Failed to create token: ${error.message}`)
+		process.exit(1)
+	}
+
+	// Build .npmrc content
+	const registryUrl = getRegistryUrl()
+	const fullRegistryUrl = registryUrl.endsWith("/api/registry")
+		? registryUrl
+		: `${registryUrl}/api/registry`
+	const registryHost = fullRegistryUrl.replace(/^https?:/, "")
+
+	// Read existing .npmrc and remove old LPM config lines
+	let npmrcContent = ""
+	if (fs.existsSync(npmrcPath)) {
+		npmrcContent = fs
+			.readFileSync(npmrcPath, "utf8")
+			.split("\n")
+			.filter(line => {
+				return (
+					!line.includes("@lpm.dev:registry") &&
+					!line.includes("lpm.dev/api/registry/:_authToken") &&
+					!line.includes("_authToken=lpm_") &&
+					// biome-ignore lint/suspicious/noTemplateCurlyInString: matching literal npm token placeholder
+					!line.includes("_authToken=${LPM_TOKEN}") &&
+					!line.includes("# LPM Registry")
+				)
+			})
+			.join("\n")
+			.trim()
+	}
+
+	const lpmConfig = `# LPM Registry (generated by lpm npmrc — do not commit)
+@lpm.dev:registry=${fullRegistryUrl}
+${registryHost}/:_authToken=${readToken}`
+
+	npmrcContent = npmrcContent ? `${npmrcContent}\n\n${lpmConfig}` : lpmConfig
+	fs.writeFileSync(npmrcPath, `${npmrcContent}\n`)
+
+	// Ensure .npmrc is in .gitignore
+	let gitignoreUpdated = false
+	if (fs.existsSync(gitignorePath)) {
+		const gitignore = fs.readFileSync(gitignorePath, "utf8")
+		if (!gitignore.split("\n").some(line => line.trim() === ".npmrc")) {
+			fs.writeFileSync(gitignorePath, `${gitignore.trimEnd()}\n.npmrc\n`)
+			gitignoreUpdated = true
+		}
+	} else {
+		fs.writeFileSync(gitignorePath, ".npmrc\n")
+		gitignoreUpdated = true
+	}
+
+	// Output
+	console.log("")
+	log.success(".npmrc configured with read-only LPM token.")
+	if (gitignoreUpdated) {
+		log.info(".npmrc added to .gitignore to prevent token leaks.")
+	}
+
+	const expiryDate = new Date(expiresAt).toLocaleDateString("en-US", {
+		year: "numeric",
+		month: "long",
+		day: "numeric",
+	})
+	log.info(`Token expires: ${expiryDate}`)
+	log.info("Run `lpm npmrc` again to refresh when expired.")
+	console.log("")
+}

package/lib/commands/setup.js

@@ -3,11 +3,36 @@ import path from "node:path"
 import * as p from "@clack/prompts"
 import chalk from "chalk"
 import { getRegistryUrl } from "../config.js"
+import { exchangeOidcInstallToken } from "../oidc.js"
 import { log, printHeader } from "../ui.js"
 
+/**
+ * Remove existing LPM config lines from .npmrc content.
+ * @param {string} content
+ * @returns {string}
+ */
+function removeLpmLines(content) {
+	return content
+		.split("\n")
+		.filter(line => {
+			return (
+				!line.includes("@lpm.dev:registry") &&
+				!line.includes("lpm.dev/api/registry/:_authToken") &&
+				!line.includes("_authToken=lpm_") &&
+				// biome-ignore lint/suspicious/noTemplateCurlyInString: matching literal npm token placeholder
+				!line.includes("_authToken=${LPM_TOKEN}") &&
+				!line.includes("# LPM Registry")
+			)
+		})
+		.join("\n")
+		.trim()
+}
+
 /**
  * Configure .npmrc for LPM packages.
- * Sets up the @lpm.dev scope to point to the LPM registry.
+ *
+ * Default mode: writes ${LPM_TOKEN} placeholder (for CI with env var).
+ * --oidc mode: exchanges CI OIDC token for a real short-lived token (no secrets needed).
  */
 export async function setup(options) {
 	printHeader()
@@ -24,6 +49,56 @@ export async function setup(options) {
 		log.warn("No package.json found. Run this command in your project root.")
 	}
 
+	// Build registry URL
+	const fullRegistryUrl = registryUrl.endsWith("/api/registry")
+		? registryUrl
+		: `${registryUrl}/api/registry`
+	const registryHost = fullRegistryUrl.replace(/^https?:/, "")
+
+	// ── OIDC mode: exchange CI token for a real short-lived install token ──
+	if (options?.oidc) {
+		let oidcToken
+		try {
+			oidcToken = await exchangeOidcInstallToken()
+		} catch (err) {
+			log.warn(`OIDC exchange failed: ${err.message}`)
+			// biome-ignore lint/suspicious/noTemplateCurlyInString: literal placeholder name in user-facing message
+			log.warn("Falling back to ${LPM_TOKEN} environment variable placeholder.")
+			// Fall through to default mode
+		}
+
+		if (oidcToken) {
+			let npmrcContent = ""
+			if (fs.existsSync(npmrcPath)) {
+				npmrcContent = removeLpmLines(fs.readFileSync(npmrcPath, "utf8"))
+			}
+
+			const lpmConfig = `# LPM Registry (OIDC — expires in 30 minutes)
+@lpm.dev:registry=${fullRegistryUrl}
+${registryHost}/:_authToken=${oidcToken}`
+
+			npmrcContent = npmrcContent
+				? `${npmrcContent}\n\n${lpmConfig}`
+				: lpmConfig
+			fs.writeFileSync(npmrcPath, `${npmrcContent}\n`)
+
+			p.note(
+				`@lpm.dev:registry=${fullRegistryUrl}\nToken: OIDC read-only (30 min)`,
+				".npmrc configuration",
+			)
+
+			console.log("")
+			log.success(".npmrc configured with OIDC read-only token.")
+			log.info("Token expires in 30 minutes. No LPM_TOKEN secret needed.")
+			console.log("")
+
+			p.outro("Setup complete!")
+			return
+		}
+	}
+
+	// ── Default mode: ${LPM_TOKEN} placeholder ──
+
 	// Check for existing .npmrc
 	let npmrcContent = ""
 	if (fs.existsSync(npmrcPath)) {
@@ -41,40 +116,18 @@ export async function setup(options) {
 				return
 			}
 
-			// Remove existing LPM config lines
-			npmrcContent = npmrcContent
-				.split("\n")
-				.filter(line => {
-					return (
-						!line.includes("@lpm.dev:registry") &&
-						!line.includes("lpm.dev/api/registry/:_authToken") &&
-						!line.includes("# LPM Registry")
-					)
-				})
-				.join("\n")
-				.trim()
+			npmrcContent = removeLpmLines(npmrcContent)
 		}
 	}
 
-	// Build registry URL
-	const fullRegistryUrl = registryUrl.endsWith("/api/registry")
-		? registryUrl
-		: `${registryUrl}/api/registry`
-
-	// Remove protocol for auth token config
-	const registryHost = fullRegistryUrl.replace(/^https?:/, "")
-
-	// Add LPM registry config
+	// Add LPM registry config with placeholder
 	const lpmConfig = `
 # LPM Registry
 @lpm.dev:registry=${fullRegistryUrl}
 ${registryHost}/:_authToken=\${LPM_TOKEN}
 `.trim()
 
-	// Combine with existing content
 	npmrcContent = npmrcContent ? `${npmrcContent}\n\n${lpmConfig}` : lpmConfig
-
-	// Write .npmrc
 	fs.writeFileSync(npmrcPath, `${npmrcContent}\n`)
 
 	p.note(
@@ -84,8 +137,9 @@ ${registryHost}/:_authToken=\${LPM_TOKEN}
 
 	console.log("")
 	log.success(".npmrc configured for LPM packages.")
-	log.info("For local development: Run `lpm login` to authenticate.")
+	log.info("For local development: Run `lpm npmrc` to generate a token.")
 	log.info("For CI/CD: Set the LPM_TOKEN environment variable.")
+	log.info("For CI/CD with OIDC: Run `lpm setup --oidc` (no secrets needed).")
 	console.log("")
 
 	p.outro("Setup complete!")

package/lib/oidc.js

@@ -1,12 +1,13 @@
 /**
- * OIDC (OpenID Connect) token exchange for secret-free publishing.
+ * OIDC (OpenID Connect) token exchange for secret-free CI operations.
  *
  * When running in GitHub Actions with `id-token: write` permission,
  * this module requests an OIDC JWT from GitHub and exchanges it for
- * a short-lived LPM publish token — no LPM_TOKEN secret required.
+ * a short-lived LPM token — no LPM_TOKEN secret required.
  *
- * The package must have a matching trusted publisher configured in
- * the LPM dashboard (Workflow tab) before this will succeed.
+ * Two modes:
+ * - **Publish**: Requires trusted publisher config in LPM dashboard.
+ * - **Read (install)**: Requires GitHub/GitLab account linked to LPM user.
  *
  * @module cli/lib/oidc
  */
@@ -39,20 +40,10 @@ export function isGitLabCiWithOidc() {
 }
 
 /**
- * Exchange a GitHub Actions OIDC JWT for a short-lived LPM publish token.
- *
- * Steps:
- * 1. Request an OIDC JWT from GitHub (audience: https://lpm.dev)
- * 2. POST the JWT to the LPM OIDC token exchange endpoint
- * 3. Return the resulting `lpm_xxx` token (valid for 15 minutes)
- *
- * @param {string} packageName - Full package name, e.g. "@lpm.dev/owner.pkg-name"
- * @returns {Promise<string>} Short-lived LPM publish token
- * @throws {Error} If GitHub OIDC request fails or LPM exchange is rejected
+ * Request a GitHub Actions OIDC JWT.
+ * @returns {Promise<string>} The raw JWT string
  */
-export async function exchangeOidcToken(packageName) {
-	// 1. Request OIDC JWT from GitHub Actions
-	// The audience must match EXPECTED_AUDIENCE in lib/registry/oidc.js on the server
+async function requestGitHubOidcJwt() {
 	const githubTokenUrl = `${process.env.ACTIONS_ID_TOKEN_REQUEST_URL}&audience=https://lpm.dev`
 
 	const githubRes = await fetch(githubTokenUrl, {
@@ -73,40 +64,72 @@ export async function exchangeOidcToken(packageName) {
 		throw new Error("GitHub OIDC response did not contain a token value")
 	}
 
-	// 2. Exchange the OIDC JWT for a short-lived LPM publish token
+	return oidcJwt
+}
+
+/**
+ * Exchange an OIDC JWT with the LPM server for a short-lived token.
+ *
+ * @param {string} oidcJwt - The raw OIDC JWT
+ * @param {{ scope?: "read"|"publish", packageName?: string }} [options]
+ * @returns {Promise<{ token: string, expiresAt: string }>}
+ */
+async function exchangeJwtWithServer(oidcJwt, options = {}) {
+	const { scope = "publish", packageName } = options
 	const registryUrl = getRegistryUrl()
-	const exchangeRes = await fetch(`${registryUrl}/api/registry/-/token/oidc`, {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify({ token: oidcJwt, package: packageName }),
-	})
+	const scopeParam = scope === "read" ? "?scope=read" : ""
+
+	const body = { token: oidcJwt }
+	if (packageName) body.package = packageName
+
+	const exchangeRes = await fetch(
+		`${registryUrl}/api/registry/-/token/oidc${scopeParam}`,
+		{
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify(body),
+		},
+	)
 
 	if (!exchangeRes.ok) {
-		const body = await exchangeRes.text().catch(() => "")
+		const text = await exchangeRes.text().catch(() => "")
 		throw new Error(
-			`OIDC token exchange failed (${exchangeRes.status})${body ? `: ${body}` : ""}`,
+			`OIDC token exchange failed (${exchangeRes.status})${text ? `: ${text}` : ""}`,
 		)
 	}
 
-	const { token } = await exchangeRes.json()
-	if (!token) {
+	const data = await exchangeRes.json()
+	if (!data.token) {
 		throw new Error("OIDC exchange response did not contain a token")
 	}
 
-	return token
+	return data
 }
 
 /**
- * Exchange a GitLab CI OIDC JWT for a short-lived LPM publish token.
+ * Exchange a GitHub Actions OIDC JWT for a short-lived LPM token.
  *
- * GitLab injects the JWT directly into LPM_GITLAB_OIDC_TOKEN via id_tokens — no
- * intermediate HTTP fetch is needed (unlike GitHub Actions).
+ * @param {string} [packageName] - Required for publish scope, optional for read
+ * @param {{ scope?: "read"|"publish" }} [options]
+ * @returns {Promise<string>} Short-lived LPM token
+ */
+export async function exchangeOidcToken(packageName, options = {}) {
+	const oidcJwt = await requestGitHubOidcJwt()
+	const data = await exchangeJwtWithServer(oidcJwt, {
+		scope: options.scope || "publish",
+		packageName,
+	})
+	return data.token
+}
+
+/**
+ * Exchange a GitLab CI OIDC JWT for a short-lived LPM token.
  *
- * @param {string} packageName - Full package name, e.g. "@lpm.dev/owner.pkg-name"
- * @returns {Promise<string>} Short-lived LPM publish token
- * @throws {Error} If the OIDC token is missing or the LPM exchange is rejected
+ * @param {string} [packageName] - Required for publish scope, optional for read
+ * @param {{ scope?: "read"|"publish" }} [options]
+ * @returns {Promise<string>} Short-lived LPM token
  */
-export async function exchangeGitLabOidcToken(packageName) {
+export async function exchangeGitLabOidcToken(packageName, options = {}) {
 	const oidcJwt = process.env.LPM_GITLAB_OIDC_TOKEN
 	if (!oidcJwt) {
 		throw new Error(
@@ -115,24 +138,29 @@ export async function exchangeGitLabOidcToken(packageName) {
 		)
 	}
 
-	const registryUrl = getRegistryUrl()
-	const exchangeRes = await fetch(`${registryUrl}/api/registry/-/token/oidc`, {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify({ token: oidcJwt, package: packageName }),
+	const data = await exchangeJwtWithServer(oidcJwt, {
+		scope: options.scope || "publish",
+		packageName,
 	})
+	return data.token
+}
 
-	if (!exchangeRes.ok) {
-		const body = await exchangeRes.text().catch(() => "")
-		throw new Error(
-			`OIDC token exchange failed (${exchangeRes.status})${body ? `: ${body}` : ""}`,
-		)
+/**
+ * Detect CI environment and exchange OIDC token for a read-only install token.
+ * Works with both GitHub Actions and GitLab CI.
+ *
+ * @returns {Promise<string>} Short-lived read-only LPM token
+ * @throws {Error} If not in a supported CI environment or exchange fails
+ */
+export async function exchangeOidcInstallToken() {
+	if (isGitHubActionsWithOidc()) {
+		return exchangeOidcToken(null, { scope: "read" })
 	}
-
-	const { token } = await exchangeRes.json()
-	if (!token) {
-		throw new Error("OIDC exchange response did not contain a token")
+	if (isGitLabCiWithOidc()) {
+		return exchangeGitLabOidcToken(null, { scope: "read" })
 	}
-
-	return token
+	throw new Error(
+		"OIDC is not available. This command requires a CI environment with OIDC support " +
+			"(GitHub Actions with `id-token: write` or GitLab CI with `id_tokens` configured).",
+	)
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@lpm-registry/cli",
-	"version": "0.2.4",
+	"version": "0.2.5",
 	"description": "CLI for Licensed Package Manager",
 	"author": "LPM <hello@lpm.dev> (https://lpm.dev)",
 	"repository": {